Links inside images, and two diagnostics that stopped lying

The ABI now carries the verbs that a filesystem with links must carry, and each one has the shape a caller already expects.

Resolution goes through the one router that already owns mount dispatch. A relative target stays in the mount that holds the link, an absolute target is matched against the longest-prefix mount table so a link inside /app may name /data, a target outside every mount remains a host path and is subject to the jail policy, and a chain longer than thirty-two hops answers ELOOP instead of running away. The preload shim maps the libc spellings onto these verbs: stat, stat64 and xstat follow, while lstat, lstat64, lxstat and readlink do not.

Six integration cases exercise the behaviour over real limnifs images: a following stat, an absolute target that crosses a mount, a cycle that answers ELOOP, opendir through a link, a dangling link, and a buffer smaller than the target.

The interposed realpath was the second half of the same fault, and it is fixed in the same release. It had routed on the lstat form and then returned its own input, so a link canonicalized to itself, a dangling link produced a path that nothing could open, and a cycle never raised an error. The canonical form now follows the hops and requires the target to exist, which is the surface the Java virtual machine reaches when it resolves a canonical file path.

The first build of this release failed on both aarch64 Linux legs and passed on both x86-64 legs. The link work’s boot arm called SYS_readlink, a constant that the libc crate defines for x86-64, s390x, mips64, sparc64 and ppc64, and aarch64 Linux carries only readlinkat. The syscall now goes through readlinkat(AT_FDCWD, …), which every Linux architecture has, and the aarch64 row passed on the corrected commit before the tag was cut again.

The failure also exposed a hole in the release path rather than only in the code. The arm row runs on merges to main and not on pull requests, which is a deliberate cost decision, so the arm row’s verdict arrives after a merge and nothing consulted it before a tag. The release workflow gained the missing check after this tag was cut: its first job now reads the continuous-integration conclusion for the commit a tag points at and refuses to create the release object unless that verdict is success. From the next tag on, a tag cut from a red commit fails by name at the first step instead of producing a release with a partial asset set.

tebako doctor reported every lock file older than one hundred and twenty seconds as stale, without asking whether anyone held it. The probe is now a non-blocking lock: a free lock is reported as a leftover from a finished run with the advice to remove it, and a held lock stays a reported problem with how long its holder has held it.

The benchmark suites declared the payload registry and not the runtime factories, so the priming dispatch had nowhere to resolve a runtime and every v2 cell in the published comparison read unavailable. The suites now register the runtime factories alongside the payload registry, which is the change that lets the comparison produce a v2 number at all. The pipeline change that follows this release makes the release’s final job dispatch the suite itself, because a release object created by the pipeline’s own token wakes no workflow.

An image-era press expanded the runtime’s environment image into a packaging tree on every invocation, which cost between 4.3 and 4.5 seconds of a loop that measured 6.19 to 7.14 seconds for the 19.2 MB image containing 2,629 files. The press now asks the resolver for the layout and copies from it, as the earlier-era path always did. The measured loop on a quiet machine is 4.01 seconds and 3.86 seconds, and 5.58 seconds for the press that performs the expansion. The derivation is marked with a digest written last beside the layout, so an interrupted extraction and an image replaced by a re-install are both rebuilt rather than trusted.

The workspace version is the only value that moves in this release, and the intra-crate pins are untouched because they carry the crate API version rather than the release line. The mounted filesystem model, the wire format and the driver contract are unchanged, so packages pressed against earlier releases on this line continue to load.